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(54) Electronic control unit and method having program rewriting function 



(57) In ECU (2) for controlling an engine, a micro- 
computer (8) executes a program in a mask ROM (21) 
after releasing the reset, determines a signal (MS) of a 
specific input terminal, and switches in accordance with 
the foregoing determination result the self operation 
mode into either one of the normal mode to execute a 
control program in a flash ROM (20). and the rewrite 
mode to update and write a data from an external unit 
(14) into the ROM (20). A monitor circuit (26) monitors a 
watchdog pulse (WP) from the microcomputer (8). out- 
puts a reset pulse (RP) to the microcomputer (8) when 
determining an abnormality, and ahers the level of the 
foregoing signal (MS) to the microcomputer (8) into the 
level of the normal mode into the level of the rewrite 
mode. 
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Description 

[0001] The present invention relates to an electronic 
control unit and method using a microcomputer, specifi- 
cally to an electronic control unH and method in which a s 
control program and control data used for the micro- 
computer performing a control process can be rewritten 
on board. 

[0002] As an electronic control unit to control, for 
example, a vehicle engine, there has been proposed the ?e 
orvboard rewritable type, which contains a microcom- 
puter including a rewritable nonvolatile memory such as 
an EEPROM or a flash EEPROM storage contents of 
which can electrically be rewritten (specifically, erased 
and newly written), and enables a control program and 75 
control data stored in the rewritable nonvolatile memory 
to be rewritten in a state that the concerned unit is com- 
pletely assembled. 

[0003] I n Japanese Patent Publication J P- A -9-442 1 6 
(USP 5.828,977), an electronic control unit is designed 2C 
to be connected to a memory rewrite unit not only 
through a communication line, but also through a mode 
determining control signal line. Immediately after a 
microcomputer of the electronic control unit starts its 
operation at the reset state, the microcomputer exe- 25 
cutes a starting program (boot program) in a non- 
rewrite-object nonvolatile memory, and thereby checks 
the state of a signal inputted from the memory rewrite 
unit through the mode determining control signal line. In 
accordance with the state of the signal, the microcom- 30 
puter switches the self operation mode into either one of 
the normal mode that executes the control prog/am in 
the rewritable nonvolatile memory and the rewrite mode 
that executes the rewrite process. 

[0004] Therefore, after the electronic control unit is ss 
powered, H it is arranged to operate the microcomputer 
from the reset state, and to output a signal indicating the 
rewrite mode to the mode determining control signal 
line from the memory rewrite unit, the microcomputer 
will execute the rewrite process without relation to the *c 
control program in the rewritable nonvolatile memory. 
Accordingly, even when the control program is not yet 
written into the rewritable nonvolatile memory, or when 
the control program stored in the rewritable nonvolatile 
memory becomes abnormal by any cause, the data 46 
write (that is, a new data write, or rewrite) into the rewri- 
table nonvolatile memory can be executed. 
[0005] However, If the mode determining control sig- 
nal line is provided between the electronic control unit 
and the memory rewrite unit, the following problems wfl) 56 
occur. 



tionaJly. 

<2> Maintenance shops of vehicles and the like have 
been using a trouble diagnostic service tool 
whereby 6 elf-diagnostics data stored in the elec- 
tronic control unit can be read through the commu- 
nication line. Accordingly, there arises a request 
from them such that the function of the memory 
rewrite unit is incorporated into the foregoing serv- 
ice tool, and thereby the control program and con- 
trol data can be written by using the communication 
line only. 

However, if the mode determining control sig- 
nal line is provided, the foregoing request will not be 
satisfied, which lacks in flexibility. That is. a special 
one will be needed as the memory rewrite unit In 
addition, the wire harness for connecting the mem- 
ory rewrite unH and the wire harness for connecting 
the other service tools cannot be integrated into 
one. 

@ In general, the connection of the electronic con- 
trol unit and the memory rewrite unit of this type is 
made such that the connector provided on the end 
of the wire harness extended from the electronic 
control unit side is engaged in the connector of the 
memory rewrite unit side. However, rf the mode 
determining control signal line inside the wire har- 
ness extended from the electronic control unit side 
is short-circuited to a part of the voltage level indi- 
cating the rewrite mode in a vehicle, the normal 
control program will not be executed. 

[0006] Here, when writing the control program and the 
control data, for example, if the operator takes a proce- 
dure to open the cover of the electronic control unit, and 
to directly apply a mode determining signal to the input 
terminal (input port) of the microcomputer, it will be pos- 
sible to dispense with the mode determining control sig- 
nal fine. However, from the workability and the reliability 
of the electronic control unit, this is not practicable. 
[0007] The present invention has an object to provide 
an electronic control unit and method that can execute a 
data write into a rewritable nonvolatile memory without 
a signal fine for determining the mode furnished 
between an external unit and the electronic control unit, 
even when a control program is not written into the 
rewritable nonvolatile memory, or when the control pro- 
gram stored in the rewritable nonvolatile memory 
becomes abnormal. 

[0008] According to the present invention, a micro 
computer is programmed to execute a control program 
composed of data stored in a rewritable nonvolatile 
memory, and executes a control process for controlling 
a control object. A monitor circuit monitors whether an 
execution state of the control program by the microcom- 
puter is normal or not. 

[0009] In this electronic control unH, specially, when 
the monitor circuit determines that the execution state of 
the control program is abnormal, the microcomputer 



0 It is necessary to add a dedicated terminal for 
the mode determining control signal line to the con- 
nector that connects the electronic control unit and ss 
the memory rewrite unit Although the mode deter- 
mining control signal line is rarely used in practice, 
a new connector terminal has to be provided addi- 
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executes a rewrite process for updating to write a 
reunite data transmitted from an external unit into the 
rewritable nonvolatile memory. 

[0010] Thus, in case the control program is not yet 
written into trie rewritable nonvolatile memory, or in case 
the control program stored in the rewritable nonvolatile 
memory becomes abnormal by any cause, the micro- 
computer is not able to execute the control program nor- 
mally. Therefore, in both of the foregoing cases, the 
monitor circuit determines the execution state by the 
microcomputer to be abnormal, and the microcomputer 
shifts the mode to the rewrite mode to execute the 
rewrite process. 

[001 1] Accordingly, although a signal line for determin- 
ing trie mode is not furnished between the external unit 
and the electronic control unit, it is possible to write a 
new control program and new control data into the 
rewritable nonvolatile memory from a state that the con- 
trol program is not written into the rewritable nonvolatile 
memory. When the control program stored in the rewri- 
table nonvolatile memory is brought into an abnormal 
state, it is possible to rewrite the concerned control pro- 
gram into a program of normal contents. 
[0012] Here, as the rewritable nonvolatile memory, an 
EEPROM or flash EE PROM is generally used, however 
other rewritable ROMs may also be used. 

Fig. 1 is a block diagram illustrating a construction 
of an electronic control unit (ECU) off one embodi- 
ment: 

Fig. 2 is a view illustrating the contents of memory 
areas; 

Fig. 3 is a flow diagram illustrating the total process 
thai a microcomputer of ECU executes; 
Fig. 4 is a flow diagram illustrating an SCI interrupt 
process that the microcomputer of ECU executes in 
the normal mode; and 

Fig. 5 is a flow diagram illustrating the process that 
a reset pulse monitoring IC constituting a monitor 
circuit executes. 

[0013] An exemplary embodiment of the invention will 
be descrbed with reference to the accompanying draw- 
ings. 

[0014] In Fig. 1 illustrating an electronic control sys- 
tem for a vehicle internal combustion engine using an 
electronic control unit (ECU) 2. the ECU 2 comprises an 
Input processing circuit (IP) 6 that Inputs signals from 
various sensors (SR) 4 for detecting the running states 
of an engine and processes the sensor signals. The 
ECU 2 further comprises a microcomputer 8 that oper- 
ates or calculates the optimum control values to the 
engine on the basis of the sensor signals from the input 
processing circuit 6 and outputs control signals on the 
basis of the operation results, an output circuit (OC) 12 
that receives the control signals from the microcom- 
puter 8 and drives actuators (A) 10 such as fuel injec- 
tors, igniter, and the like which are mounted on the 



engine. The ECU 2 further comprises a communication 
circuit (CC) 16 for executing a serial data communica- 
tion with a memory rewrite unit 14, which is an external 

unit. 

s [0015] The micro computer 8 includes a central 
processing unit (CPU) 18 that operates in accordance 
with a program, a nonvolatile flash EEPROM 20 and a 
mask ROM 21 that store a program (specifically, data 
constituting the program) required for operating the 

10 CPU 1 8 and data to be referred to during the execution 
of the Program by the CPU 18, a volatile RAM 22 thai 
temporarily stores the operation results by the CPU 18, 
etc.. and an input/output circuit (I/O) 24. The I/O 24 
receives the signals from the input processing circuit 6 

75' and the communication circuit 16, etc., and outputs the 
control signals to the output circuit 12. 
[0016] The flash EEPROM 20 is a nonvolatile ROM, 
the storage contents of which can electrically be rewrit- 
ten (erased and newly written). The mask ROM 21 is a 

20 nonvolatile ROM, the storage contents of which cannot 
be rewritten. However, in case that a flash EEPROM or 
an EEPROM is used as a substitute of the mask ROM 
21. the erasing and writing only need to be inhibited to 
the storage contents. 

25 [001 7J Here, the contents of memory areas ol the 
flash EEPROM 20, mask ROM 21. and RAM 22 will be 
described with reference to Fig. 2. 
[0018] As shown in Fig. 2, the flash EEPROM 20 is 
used as an engine control program and data (pro- 

30 gram/data) storage area 32 for storing the control pro- 
gram and control data for an engine control. After the 
microcomputer 8 is mounted on the board of ECU 2 in 
the manufacturing process of ECU 2. applicable control 
program and control data are written in the Hash EEP- 

35 ROM 20. Here, the control program and control data are 
assumed to have already been written therein. 
[0019] On the other hand, the mask ROM 21 is used 
as a boot program storage area 34 for storing a boot 
program executed immediately after a reset releasing, 

40 and an applicable boot program is stored in advance in 
this mask ROM 21 before the microcomputer 8 is 
mounted on the board of ECU 2. 
[0020] The RAM 22 is provided with a flash ROM 
rewriting control program storage area 36 and an oper- 

46 ation work area 38. A flash ROM rewriting control pro- 
gram transmitted from the memory rewrite unit 14 
described later is transferred to the flash ROM rewriting 
control program storage area 36 In order to rewrite the 
storage contents of the flash EEPROM 20. The opera- 

so tion work area 38 is used for an operation work when 
the flash ROM rewriting control program is executed. 
[0021 ] Furthermore, each of the boot program in the 
mask ROM 21 , the control prog nam stored (written> in 
the flash EEPROM 20. and the flash ROM rewriting con- 

55 trol program transmitted from the memory rewrite unit 
14 to the flash ROM rewriting control program storage 
area 36 of the RAM 22 contains a watchdog pulse out- 
putting program by which the microcomputer 8 outputs 
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an operation monitoring watchdog pulse WP at each 
time equal to or less than a predetermined specific time 
TW. 

[0022] Referring again to Fig. 1. the memory rewrite 
unit 14 is connected to ECU 2, when the control pro- s 
gram and control data for the engine control are written 
afresh in the flash EE PROM 20, or the already written 
control program and control data are rewritten by new 
contents. The connection of ECU 2 and the memory 
rewrite unit 14 is made by engaging connectors CN of re 
both, so that communication line L of both are con- 
nected in terms of signals. That is, to engage the con- 
nectors CN enables the microcomputer 8 of ECU 2 to 
conduct a serial communication with the memory 
rewrite unit 14 through the communication circuit 1 6 and 75 
the com muni cation line L. 

[0023] Further, ECU 2 comprises a monitor circuit 26 
for monitoring the operation state of the microcomputer 
8, and the monitor circuit 26 contains a power supply IC 
28 with a watchdog pulse monitoring function and a zc 
reset putse monitoring IC 29. 

[0024] Here, the power supply IC 28 possesses the 
following three -functions (1) - (3). (1) An operation volt- 
age supply function that converts a power supply volt- 
age (normally, about 12 volts Irom a battery, supplied 2S 
through the ignition switch of a vehicle or the like) 
applied to ECU 2 into an operation voltage of 5 volts and 
supplies it to the microcomputer S, output circuit 1 2, and 
the like inside ECU 2. (2) The power-on reset function 
that continues to supply a reset signal Id a reset termi- ac 
nal of the microcomputer 8 for a period from when the 
supply of the operation voltage is started with the input 
of the power supply voltage until when the operation 
voltage is regarded to have reached a stabilized level. 
(3) The watchdog pulse monitoring function (the watch- ss 
dog putse timer function) that monitors the watchdog 
pulse to be outputted at each time equal to or less than 
the foregoing specific time TW accompanied with the 
program execution by the microcomputer 8, and outputs 
a reset pulse RP of a predetermined time width to the «c 
reset terminal of the microcomputer 8 when the output 
period is abnormal, that is. when the watchdog pulse 
WP is not outputted from the microcomputer 6 within a 
timer time TM that is set longer than the foregoing spe- 
cific time TW 45 
[0025] The reset pulse monitoring IC 29 is formed of 
a small-scaled microcomputer (for example, one bit 
microcomputer) having a simplified construction, and 
executes the processing shown in Fig. 5 with the opera- 
tion voltage supplied from the power supply IC 28. so 
[002C] That is. at step (S) S1000. whether the reset 
pulse RP is generated from the power supply IC 28 to 
the microcomputer 8 is determined, and if the reset 
putse RP is determined to be not generated, the proc- 
ess is shifted to 81020. If the reset pulse RP is deter- 55 
mined to be generated, a counter CRST for counting the 
number of the reset pulses being generated is incre- 
mented by 1 at the following S101D, and then the proc- 



ess advances to SI 020. 

[0027] At S1020. the value of the counter CRST Is 
determined as to whether it is equal to or more than a 
predetermined value n larger than 1. and if the value of 
the counter CRST is determined to be equal to or more 
than the predetermined value n, an actuator drive stop 
signal AS with the active level (for example, low level - 
0 volt) is outputted to the output circuit 12 at the follow- 
ing SI 030. Receiving the stop signal AS, the output cir- 
cuit 12 stops driving the actuator 10 regardless of the 
control signal from the microcomputer 8. 
[0028] In other words, directly after receiving the oper- 
ation voltage from the power supply IC 28 and starting 
the operation, the reset, pulse monitoring IC 29 has 
started to output the actuator drive stop signal AS with 
the passive level (for example, high level = 5 volts) to the 
output circuit 12. In this state, the drive of the actuator 
1 0 by the output circuit 12 is possible. When the reset 
pulse RP is outputted repeatedly (n > 1) to the micro- 
computer 8 from the power supply IC 28 and the value 
of the counter CRST becomes equal to or more than the 
predetermined value n. the reset pulse monitoring IC 29 
determines the operation of the microcomputer 8 to be 
abnormal, and alters the level of the actuator drive stop 
signal AS to the output circuit 12 into the active level. 
Thereby, the drive of the actuator 1 0 by the output circuit 
1 2 is forcibly stopped. Here, this forcible stop state con- 
tinues until the power supply to ECU 2 is cut off. 
[0029] Next, when the actuator drive stop signal AS is 
brought into the active level at the foregoing S1030, or 
when the value of the counter CRST is determined to be 
less than the predetermined value n at the foregoing 
31 020, the process is shifted to S1 040. where the value 
of the counter CRST is determined as to whether it is 
equal to or more than a predetermined value m larger 
than 1. 

[0030] If the value of the counter CRST is not equal to 
or more than the predetermined value m. the process 
returns to S1000. However, if the value of the counter 
CRST is equal to or more than the predetermined value 
m. the reset pulse monitoring IC 29 outputs a mode 
determining control signal MS with the active level (for 
example, tow level » 0 V) corresponding to a rewrite 
mode to a specific input terminal (mode determining 
input terminal) of the microcomputer 8. Then, the proo- 
ess returns to S1000. 

[0031] As described above, immediately after receiv- 
ing the operation voltage from the power supply IC 28 
and starting the operation, the reset pulse monitoring IC 
29 starts to output the mode determining control signal 
MS with the passive level (for example, high level «5V) 
corresponding to a normal mode to tie foregoing mode 
determining input terminal of the microcomputer 8. 
When the reset pulse RP is outputted for m times to the 
microcomputer 8 from the power supply IC 28 and the 
value of the counter CRST becomes equal to or more 
than the predetermined value m, the reset pulse moni- 
toring IC 29 determines the operation of the microcom- 



4 



PACE 19/29 * RCVD AT B/23/2005 2:11:05 AM [Eastern Daylight Time] • SVR:U8PTO-EFXRF-1/0 ■ ONI8: 8729306 • C8ID: * DURATION (mm-*s):13-12 



TO: 17038729386 (17838729306) 02:18 06/23/05 EST Pg 28- 



EP0 945 770A2 



puter 8 to be abnormal, and alters the level of the mode 
determining control signal MS to the foregoing mode 
determining input terminal Into the active level corre- 
spond ng to the rewrite mode. Here, this state continues 
until the power supply to ECU 2 is cut off. 
[0032] In ECU 2 thus constructed, the microcomputer 
8 starts the operation from the reset state, and executes 
the boot program in the mask ROM 21 that is set as a 
reset entry address as shown in Fig. 2. whereby the 
microcomputer 8 determines the level of the mode 
determining control signal MS inputted to the foregoing 
mode determining input terminal. In accordance with 
the level of the mode determining control signal MS at 
that time, the microcomputer 8 switches the operation 
mode thereafter into either one of the normal mode that 
executes the control program in the flash EEPROM 20 
and the rewrite mode that executes a rewrite processing 
for updating to write in the flash EEPROM 20 rewrite 
data (that is, new control program and control data) 
transmitted from the memory rewrite unit 14. 
[0033] Next, the process executed by the microcom- 
puter 8 will now be described with reference to Fig. 3 . 
Here, Fig. 3 is a flow diagram illustrating the total proc- 
ess executed by the microcomputer 8, in which the 
processes of Si 00 ~ S300, and S500 are executed by 
the boot program in the mask ROM 21 . The process of 
S400 is executed by the flash ROM rewriting control 
program that the memory rewrite unit 14 transmits to the 
RAM 22. The processes of S600 - S800 are executed 
by a control program for an engine control (engine con- 
trol program) in the flash EEPROM 20. 
[0034] As shown in Fig. 3, starting the operation at the 
reset state, first the microcomputer 8 starts executing 
the boot program in the mask ROM 21 . 
[0035] First at S100. the microcomputer 8 checks the 
level of the mode determining control signal inputted to 
its own mode determining input terminal from the reset 
pulse monitoring IC 29 of the monitor circuit 26. 
[0036] If the mode determining control signal is active, 
the microcomputer 8 determines it to be the rewrite 
mode, and advances the process to S200. At this S200. 
the flash ROM rewriting control program is downloaded 
into the RAM 22 from the memory rewrite unit 14. 
[0037] That is, after the specific operation is finished, 
the memory rewrite unit 1 4 is designed to read out the 
flash ROM rewriting control program from the con- 
cerned storage media such as a ROM or a magnetic 
disk set on the memory rewrite unit 14 and to transmit 
the program to ECU 2 through the communication line 
L Then, by the process of S200, the microcomputer 8 
receives the Hash ROM rewriting control program from 
the memory rewrite unit 14. and stores the program on 
the flash ROM rewriting control program storage area 
36 on the RAM 22. 

[0038] After downloading of the flash ROM rewriting 
control program on the RAM 22 is completed by the 
process of S200. the process advances to S300. and 
jumps to the process start address of the flash ROM 
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rewriting control program storage area 38 on the RAM 
22. The flash ROM rewriting control program is exe- 
cuted on the RAM 22. As shown in S400, the rewrite 
process for updating to write the write data transmitted 
s from the memory rewrite unit 1 4 into the flash E E P ROM 
20 is executed. 

[0039] Further, the rewrite process of the flash ROM 
rewriting control program is executed, for example, by 
the following procedure. 

10 

1. Read in an object address (or, erase object 
block) for writing data from the memory rewrite unit 
14 through the communication line L. and erase old 
data from the object address (or. erase object 

15 block) in the flash EEPROM 20. 

2. Read in write data (that is. new data constituting 
a new control program and new control data) from 
the memory rewrite unit 14 through the communi- 
cation line L, and write the data in the area on the 

20 flash EEPROM 20 where the old data are erased. 

3. Receive all the control programs and control data 
that should be rewritten from the memory rewrite 
unit 14, output a rewrite completion signal to the 
memory rewrite unit 14 through the communication 

25 line L after completing to rewrite the flash EEPROM 
20, and thereafter repeat to output this rewrite com- 
pletion signal, entering into an infinite loop. 

[0040] Then, the memory rewrite unit 14 receives the 

30 foregoing rewrite completion signal, and displays a 
message of the rewrite complete on a specific display 
(not illustrated)- Accordingly, the operator watches the 
message of the rewrite completion, and thereby recog- 
nizes that the data rewrite in the flash EEPROM 20 is 

35 completed. 

[0041] On the other hand, if the mode determining 
control signal is determined as passive at Si 00 of the 
boot program, the microcomputer 8 determines it to be 
an engine control mode as the normal mode to advance 

40 the process to S500. At this S500. the process jumps to 
the engine control program in the flash EEPROM 20. 
[0042] Thereafter, the engine control program in the 
flash EEPROM 20 is executed, and the processes of 
S600 - S800 are executed. 

46 [0043] That is, first at S600. an engine control routine 
as the control process for controlling an engine is exe- 
cuted. Further, this engine control routine is executed in 
accordance with a procedure such that an optimum fuel 
consumption, ignition timing, and the like of the engine 

so are calculated on the basis of the various sensor signals 
from the input processing circuit 6 and the control data 
in the flash EEPROM 20, and in accordance with the 
calculation results, the control sisals for driving the 
actuators 10 of a fuel Injector, igniter, and the like are 

55 outputted. 

[0044] While this engine control routine is repetitively 
executed, the engine is driven in electronically-control- 
led manner. However, after the execution of the engine 
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control routine is completed in an ordinary manner, 
before the same routine is repeated again, at the tallow- 
ing S700. whether a Hash ROM rewrite request com- 
mand from the memory rewrite unit 14 is received or not 
is determined on the basis o1 the status of a flash ROM 5 
rewrite request flag XWRITE. 

[0045] This flash ROM rewrite requestflag XWRITE is 
set in the process of an SCI interrupt that executes 
interruptions, when the serial data are received from the 
memory rewrite unit 14 through the communication line ic 
l_ 

[0046] That is, receiving the serial data from the mem- 
ory rewrite unit 14 while executing the engine control 
program, the microcomputer 8 executes the SCI inter- 
rupt process as shown in Fig. 4. First at S910, the is 
microcomputer 8 determines whether the flash ROM 
rewrite request command W as a rewrite instruction is 
received from the memory rewrite unit 14. If it is the 
flash ROM rewrite request command W, at the follow- 
ing S920, the Hash ROM rewrite request flag XWRITE is 20 
set and then the concerned SCI interrupt process is 
ended. If it is not the flash ROM rewrite request com- 
mand, the concerned SCI interrupt process is ended. 
Here, the program of this SCI interrupt process is 
included in the engine control program in the flash E EP- 25 
ROM 20. 

[0047] Therefore, each time the engine control routine 
(S600) is repeated, the set status of the flash ROM 
rewrite request flag XWRITE is checked (S700). rf the 
flag XWRITE is not set. immediately the engine control 30 
routine (S600) is repeated. 

[0048] On the other hand, at the foregoing S700, rf the 
flash ROM rewrite request flag XWRITE is determined 
to be set, that rs> when the flash ROM rewrite request 
command is received, the rewrite condition is deter- ss 
mined to be complete, and the process advances to the 
following S800 without repeating the engine control rou- 
tine. At this S800. the flash ROM rewrite request flag 
XWRITE is reset, and then the process moves to S200 
of the foregoing boot program. *c 
[0049] Therefore, if it also receives the flash ROM 
rewrite request command from the memory rewrite unit 
14 while executing the engine control program, the 
microcomputer 8 will shift the self operation mode to the 
rewrite mode. The flash ROM rewriting control program 46 
from the memory rewrite unit 14 is executed on the 
RAM 22 by the foregoing processes S200 - 5400. and 
thereafter, the rewrite process that updates to write the 
write data transmitted from the memory rewrite unit 14 
in the flash E EPROM 20 is executed. so 
[0050] in this case, when the program part of S700 
and S800 is rewritten into the same content or an 
improved content, the function to transfer the engine 
control state to the rewrite mode is maintained. It may 
be arranged that the program part of S700 and S800 is ss 
not rewritten, and only the program part of the engine 
control routine of S600 is rewritten. 
[0061] In ECU 2 of this embodiment as above, when 



the power supply voltage is applied thereto, by the 
power-on reset function of the power supply IC 28 con- 
stituting the monitor circuit 26. the microcomputer 8 
starts the operation from the reset state, executes the 
boot program in the mask ROM 21 first and at S1C0, 
determines that the mode is the engine control mode as 
the normal mode. This results from, as descrtoed 
above, that immediately after receiving the operation 
voltage from the power supply IC 28 and starting Ihe 
operation, the reset pulse monitoring IC 29 outputs the 
mode determining control signal MS with the passive 
level corresponding to the normal mode to the mode 
determining input terminal of the microcomputer 8. 
[0052] The microcomputer 8 transfers the process 
from the boot program to the engine control program in 
the flash E EPROM 20 (SSOO), and repeatedly executes 
the engine control routine (S600) on the basis of the 
engine control program to thereby control the engine. 
While it executes the engine control routine repeatedly, 
the microcomputer 8 periodically executes the watch- 
dog pulse otrtputting program contained in the engine 
control program, and outputs the operation monitoring 
watchdog pulse WP at each time equal to or lees than 
the specific time TW to the monitor circuit 26. 
[0053] Here, in case that the control content of the 
engine is modified, in the stale that the microcomputer 
8 repeatedly executes the engine control routine as 
above, it is sufficient to arrange that the memory rewrite 
unit 14 is connected to the concerned ECU 2 and the 
flash ROM rewrite request command is transmitted to 
ECU 2 from the memory rewrite unit 14. 
[0054] In other words, at S700 of the engine control 
program, when it determines to be in receipt of the llash 
ROM rewrite request command from the memory 
rewrite unit 14. the microcomputer 8 determines that the 
rewrite condition is established, and transfers the self 
operation mode to the rewrite mode. 
[0055] In this rewrite mode, the microcomputer 8 
downloads the flash ROM rewriting control program 
from the memory rewrite unit 14 on the RAM 22 (S200) 
based on a specific handshake with the memory rewrite 
unit 14, and transfers the process to the execution proc- 
ess of the llash ROM rewriting control program (S300), 
whereby the microcomputer 8 will execute the rewrite 
process (S400) lor updating to write in the flash EEP- 
ROM 20 the rewrite data (new engine control program 
and new control data) transmitted from the memory 
rewrite unit 1 4. 

[0056] Thereafter, completing the rewrite process o1 
the flash EEPROM 20. the microcomputer 8 transmits 
the rewrite completion signal to the memory rewrite unit 
14. so that the memory rewrite unit 14 has a message 
of the rewrite completion displayed on the display 
thereof. 

[0057] Accordingly, after confirming that the message 
of the rewrite completion is displayed, it is only needed 
that the operator cuts off the supply of the power supply 
voltage, removes the memory rewrite unit 14 from the 
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communication line L, and applies the power supply 
voltage to ECU 2 again. 

[0058] As described above, the microcornputer 8 
determines the mode as the normal mode (engine con- 
trol mode) at S100 of the boot program, and executes 
the engine control program in the flash EEPROM 20. 
However at this moment, the engine control program 
and the control data in the flash EEPROM 20 are rewrit- 
ten into new contents. Accordingly, an engine control of 
the different contents from the one before rewritten is 
carried out in the engine control routine executed at 
S600. 

[0059] When the microcomputer 8 is in the midst of 
executing the rewrite process of S400. tor example, if 
the supply of the power supply voltage to ECU 2 is cut 
off, or if the connection between ECU 2 and the memory 
rewrite unit 14 is broken off, the rewrite process is sus- 
pended, so that the microcomputer 8 is brought into a 
state such that the engine control program in the flash 
EEPROM 20 cannot be executed normally. 
[0060] In case that the data write into the flash EEP- 
ROM 20 results in a failure as above, it is necessary to 
write and correct the storage content of the flash EEP- 
ROM 20. However, once the engine control program in 
the flash EEPROM 20 falls into a state being abnormal, 
the microcomputer 8 is not able to determine the com- 
pleteness/incompleteness of the rewrite condition by 
S700 in Fig. 3. Therefore, even though the memory 
rewrite unit 14 transmits the flash ROM rewrite request 
command to ECU 2. the microcomputer 8 becomes 
unable to shift the operation mode from the engine con- 
trol mode to the rewrite mode. 

[0061] Similarly, in the manufacturing process of ECU 
2, etc., also in the initial state such thai the control pro- 
gram and the control data are not yet written in the flash 
EEPROM 20, the microcomputer 8 is not able to deter- 
mine the complsteness/incomplsteness of the rewrite 
condition by S700 in Fig. 3. Therefore, even though the 
memory rewrite unh 14 is connected to ECU 2 and the 
flash ROM rewrite request command is transmitted to 
ECU 2 from the memory rewrite unit 14, the operation 
mode of the microcomputer 8 cannot be shifted to the 
rewrite mode. 

[0062] However, according to ECU 2 of this embodi- 
ment, even in case the control program in the flash 
EEPROM 20 becomes abnormal by any cause, or even 
in case the control program is not yet written into the 
flash EEPROM 20, the operation described hereafter 
makes it possible not only to bring the operation mode 
of the microcomputer 8 into the rewrite mode, but also 
to execute the data write (specifically, rewrite or new 
write of the control program, etc.) into the flash EEP- 
ROM 20. 

[0063] That is, in case the control program stored in 
the flash EEPROM 20 is in an abnormal state by any 
cause, or In case the control program is not yet written 
into the flash EEPROM 20. if the power supply voltage 
is applied to ECU 2 to operate the microcomputer 8 



from the reset state, the microcomputer 8 will shift the 
operation to the execution of the control program (S600) 
in the flash EEPROM 20 from S500 of the boot pro- 
gram. However in this case, the microcomputer 8 is not 

s able to execute the control program normally, and in 
consequence, the microcomputer 8 will not be able to 
output the watchdog pulse WP that should be outputted 
at each time equal to or less than the specific time TW. 
[0064] The power supply IC 28 of the monitor circuit 

io 26 determines that the execution state of the control 
program by the microcomputer 8 is abnormal, and out- 
puts the reset pulse RP to the reset terminal of the 
microcomputer 8. Accordingly, the microcomputer 8 will 
start the operation again from the reset state, and shHt 

75 the operation from S500 of the boot program to the exe- 
cution of the control program (S600) in the flash EEP- 
ROM 20. 

[0065] Here, in case the control program stored in the 
flash EEPROM 20 is in an abnormal state, or in case the 

20 control program is not written into the flash EEPROM 
20, even though the reset pulse RP is supplied to the 
microcomputer B. the control program is not executed 
normally, and the watchdog pulse WP is not outputted 
at each time equal to or less than the specific time TW 

25 from the microcomputer 8. 

[0066] Therefore, the state continues in which the 
reset pulse RP is outputted from the power supply iC 28 
to the microcomputer 8. in which the execution state of 
the control program by the microcomputer 8 does not 

30 become normal, even though the reset pulse RP is out- 
putted to the microcomputer 8. 

[0067] When the m-th reset pulse RP (m > 1) is out- 
putted to the microcomputer 8 from the power supply IC 
28, by the processes of S1040 and SI 050 in Fig. 5, the 

35 reset pulse monitoring IC 29 of the monitor circuit 26 
alters the level of the mode determining control signal 
MS that the reset pulse monitoring IC 29 outputs to the 
mode determining input terminal of the microcomputer 
8 from the passive level into the active level correspond- 

40 ing to the rewrite mode. 

[0068] Then, the microcomputer 8 will start the oper- 
ation again from the reset state by the foregoing m-th 
reset pulse RP. In this case, the mode determining con- 
trol signal MS inputted to the mode determining input 

46 terminal of the microcomputer 8 from the reset pulse 
monitoring IC 29 is in the active level corresponding to 
the rewrite mode. Accordingly, the microcomputer 8 
determines the mode as the rewrite mode by S100 of 
the boot program, and executes the processes of S20O 

so ~ S400. regardless of the storage contents of the flash 
EEPROM 20. 

[0069] Therefore in this state, connecting the memory 
rewrite unit 14 to ECU 2. and sequentially transmitting 
from the memory rewrite unit 14 to ECU 2 the flash 
55 ROM rewriting control program, the object address for 
writing the data, and the write data to be written will 
make ft possible to write a desired control program and 
control data into the flash EEPROM 20. 
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[0070] Thus, in ECU 2 of this embodiment, in case 
that the execution state of the control program by the 
microcomputer 8 is determined to be abnormal by the 
monitor circuit 26, the microcomputer 8 transfers the 
mode to the rewrite mode to execute the rewrite process 5 
(S400). Therefore, without a special mode determining 
signal line provided between the microcomputer 8 and 
the memory rewrite unit 14. in case the control program 
stored in the flash EEPROM 20 has been brought into 
an abnormal state, or in case the control program is not 
written into the flash EEPROM 20. the microcomputer 8 
is able to write the data into the flash EEPROM 20. 
[0071] That is. if there is not a special mode determin- 
ing signal line provided between the microcomputer 8 
and the memory rewrite unit 14. in case the control pro- 
gram written in the flash EEPROM 20 has been brought 
into an abnormal state, the microcomputer 8 is able to 
write and correct the concerned control program into a 
normal content. From the state in which the control pro- 
gram is not written into the flash EEPROM 20, the 
microcomputer 8 is able to write a new control program 
and control data into the flash EEPROM 20. 
[0072] Therefore, according to ECU 2 of this embodi- 
ment. ECU 2 can be connected to the memory rewrite 
unit 14- through only the communication line L. and is 
able to solve all the conventional problems. 
[0073] Moreover, in ECU 2 of this embodiment the 
reset pulse monitoring IC 29 constituting the monitor cir- 
cuit 26 counts the output frequency of the reset pulse 
RP OLrtputied to the microcomputer 8 from the power 
supply IC 28 constituting the monitor circuit 26 alike, 
and when the m-th (M > 1) reset pulse RP is outputted 
to the microcomputer 8. the reset puJse monitoring IC 
29 is arranged to alter the level of the mode determining 
control signal MS suppfied to the mode determining 
input terminal of the microcomputer 8 into the active 
level corresponding to the rewrite mode. Accordingly, 
although the reset pulse RP is outputted to the reset ter- 
minal of the microcomputer 8, only when the state in 
which the execution state of the control program does 
not become normal continues for m- times, the monitor 
circuit 26 will output the mode determining control sig- 
nal MS with the active level corresponding to the rewrite 
mode to the mode determining input terminal of the 
microcomputer 8. 

[0074] Therefore, according to ECU 2 of this embodi- 
ment, when a normal returnable improper program exe- 
cution occurs by the reset pulse RP In the midst that the 
microcomputer 8 executes a normal control program in 
the flash EEPROM 20. the execution state of the control 
program by the microcomputer 8 can swiftly be restored 
to the normal state only by the reset pulse RP from the 
power supply IC 28, without shifting the operation mode 
of the microcomputer 8 to the rewrite mode. 
[0075] That is. the case in which a normal returnable 
improper program execution occurs in the microcom- 
puter 8 is distinguished from the case in which a data 
write into the flash EEPROM 20 is necessary (that is. 



the case in which the control program is not written into 
the flash EEPROM 20. or the case in which the control 
program stored In the flash EEPROM 20 becomes 
abnormal by any cause), and only when a data write 
into the flash EEPROM 20 is definitely necessary, the 
operation mode of the microcomputer 8 can be shifted 
to the rewrite mode. 

[0076] If the normal return from a improper program 
execution is not needed to be considered, the specific 
value m that the reset pulse monitoring IC 29 deter- 
mines al S1040 in Fig. 5 can be set to "1". If this is 
arranged and the monitor circuit 26 determines the exe- 
cution state of the control program by the microcom- 
puter 8 as being abnormal, the monitor circuit 26 will 
always output the reset pulse RP to the reset terminal of 
the microcomputer 8, and output the mode determining 
control signal MS with the active level corresponding to 
the rewrite mode to the mode determining input terminal 
of the microcomputer 8. 

[0077] Furthermore, according to ECU 2 of this 
embodiment, the microcomputer 8 determines to shift 
the operation mode to either one of the rewrite mode 
and the normal mode, by only determining the signal 
level of the mode determining input terminal in the boot 
program executed directly after releasing the reset. 
Therefore, the microcomputer 8 is not necessary to 
remain in the boot program for a long time, and the 
microcomputer 8 is able to reduce to a minimum a delay 
time before the start of executing the control program in 
the normal state that the data write into the flash EEP- 
ROM 20 is not executed. Since the boot program can be 
made up with a simple construction, a small capacity 
memory can be used as the mask ROM 21 to store the 
boot program. 

[0078] The invention is not limited to the foregoing 
embodiment and naturally various modifications and 
changes can be made to the embodiment. 
[0079] For example, it may be so arranged that when 
the generation period of the reset pulse RP is shorter 
than a predetermined time, and in addition, the genera- 
tion frequency reaches the specific value m ( > 1). the 
level of the mode determining control signal MS to the 
microcomputer 6 is altered from the passive level into 
the active level. 

[0080] In this instance, the case in which a normal 
returnable improper program execution occurs in the 
microcomputer 8 can be distinguished more reliably 
from the case In which the control program Is not written 
into the flash EEPROM 20, or the case in which the con- 
trol program stored in the flash EEPROM 20 becomes 
abnormal. 

[0081] Further, the reset pulse monitoring IC 29 may 
be constructed such that the execution state of the con- 
trol program by the microcomputer 8 is determined as 
being normal or not, by monitoring the output period of 
the watchdog pulse WR That is, the reason is that after 
a specific timer time TM counted by the power supply IC 
28 has passed, if the watchdog pulse WP is not output- 
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ted from the microcomputer 8, the operation state of the 
microcomputer 8 can be determined as not having 
returned to the normal state although the microcom- 
puter 8 has received the reset pulse RP from the power 
supply IC 28 for plural times. s - 

[0082] On the other hand, it may be arranged to make 
the reset pulse monitoring IC 29 bear the watchdog 
pulse monitoring function (watchdog timer function) that 
the power supply IC 28 holds, and to output the reset 
pulse RP Irom the reset pulse monitoring IC 29 thus io 
arranged to the microcomputer a. 
[0083] Further, the monitor circuit 26 may be made up 
with one IC in stead of the two separate ICs 28 and 29. 
[0084] Here, regardless of what the control program in 
the flash EEP ROM 20 is abnormal in Itself, there is also 75 
a possibility that successfully carries out the program 
part to output the watchdog pulse WP. Accordingly, it 
may be arranged, for example, that before starting to 
execute the control program in the flash EEP ROM 20 
(before jumping to the control program at S500 in Fig. 20 
3), Ihe microcomputer 8 executes a sum check as to the 
data in the flash EE PROM 20. and in case of the sum 
check being abnormal, stops to output the watchdog 
pulse WP thereafter. This arrangement will detect more 
accurately that the control program in the flash EEP- 25 
ROM 20 is abnormal, so that the operation mode can be 
shifted to the rewrite mode, where the control program 
can be rewritten. 

[0085] On the other hand, in ECU 2 of the foregoing 
embodiment, the flash ROM rewriting control program is 30 
designed to be received from the memory rewrite unit 
1 4. However, it may be arranged to store the flash ROM 
rewriting control program in advance in a non-rewrite- 
object nonvolatile memory (for example, the mask ROM 

21). 35 

[0086] Further, in ECU 2 of the foregoing embodi- 
ment, the flash EEP ROM 20 is employed as the rewrfta- 
bie nonvolatile memory: however, the other ROMs that 
are electrically rewritable, such as EEP ROM, may be 
employed. to 
[0087] Furthermore. ECU 2 of the foregoing embodi- 
ment is intended to control the engine of a vehicle. How- 
ever, the invention can be applied in the entirely same 
manner to the electronic control unit that controls the 
other control objects, for example, the brake, transrnis- 46 
sion, suspension, and the like. 

[0088] In ECU (2) for controlling an engine, a micro- 
computer (8) executes a program In a mask ROM (21) 
after releasing the reset, determines a signal (MS) of a 
specific input terminal, and switches in accordance with so 
the foregoing determination result the self operation 
mode into either one of the normal mode to execute a 
control program in a flash ROM (20) and the rewrite 
mode to update and write a data from an external unit 
44) into the ROM (20). A monitor circuit (26) monitors a ss 
watchdog pulse (WP) from the microcomputer (8). out- 
puts a reset pulse (RP) to the microcomputer (8) when 
determining an abnormality, and alters the level of the 



foregoing signal (MS) to the microcomputer (8) into the 
level of the normal mode into the level of the rewrite 
mode. 

Claims 

1. An electronic control unit (2) connectable to an 
external unit (14), comprising: 

a microcomputer [8) that executes a control 
program composed of data stored in a rewrita- 
ble nonvolatile memory (20) storage contents 
of which can electrically be rewritten, and exe- 
cutes a control process for controlling a control 
object (10); and 

monitor circuit (26) that monitors whether an 
execution state of the control program by the 
microcomputer [8) is normal or abnormal, 
wherein the microcomputer (8) is constructed 
to execute a rewrite process for updating to 
write a rewrite data transmitted from the exter- 
nal unit (14) into the rewritable nonvolatile 
memory (20), when the execution state of the 
control program is determined to be abnormal 
by the monitor circuit (26). 

2. An electronic control unit according to Claim 1, 
wherein: 

the microcomputer (8) is constructed to exe- 
cute, immediately after starting an operation 
from a reset state, a starting program stored in 
a non-rewrite-object nonvolatile memory (21) 
thereby determining a level of a mode deter- 
mining binary signal (MS) inputted to a sell 
specific Input terminal, and in accordance with 
the level of the mode determining binary signal 
(MS), switch a self operation mode into either 
one of a normal mode to execute the control 
program stored in the rewritable nonvolatile 
memory (20) and a rewrfte mode to execute the 
rewrite process; and 

the monitor circuit (26) is constructed to output 
a reset pulse (RP) for resetting the microcom- 
puter (8) to a reset terminal of the microcom- 
puter (8), and outputs the mode determining 
binary signal (MS) of a level corresponding to 
the rewrite mode to the specific Input terminal 
of the microcomputer (8), when determining 
the execution stats of the control program by 
the microcomputer (8) as being abnormal. 

3. An electronic control unit according to Claim 2, 
wherein: 

the monitor circuit (26) is constructed to output 
the mode determining binary signal (MS) of a 
level corresponding to the rewrite mode to the 
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specific input terminal of the microcomputer 
(8). only when a state in which the execution 
state of the control program by the microcom- 
puter (8) is abnormal continues for a plurality of 
times under a condition that the monitor circuit s 
(26) outputs the reset pulse. 



4. An electronic control unit according to any one of 
Claims 1 to 3. wherein: 

1C 

the microcomputer (8) is constructed to deter- 
mine whether a predetermined rewrite condi- 
tion is satisfied or not when executing the 
control program in the rewritable nonvolatile 
memory (20). and to shift the sell operation 75 
mode to the rewrite mode to exacute the 
rewrite process when determining that the 
rewrite condition is satisfied. 



5. An electronic control method for a microcomputer 20 
(8) having a CPU (18) for executing a first control 
program, a nonvolatile rewritable memory (20) stor- 
ing the control program and a monitor circuit (26). 
the microcomputer (8) being connectable to an 
external rewrite unit (14) for transmitting a second 2s 
control program, the method comprising the steps 
ol: 

monitoring (S1000-S1040), by the monitor cir- 
cuit (26). a first control program execution proc- 30 
ess of the microcomputer (8); 
applying (Si 050) a monitor signal (MS) indica- 
tive of a monitoring result from the monitor cir- 
cuit (26) to the microcomputer (8); 
transmitting (S100-S200) the second control ss 
program from the external rewrite unit (14) to 
the microcomputer (8); and 
rewriting (SS300-S400) the transmitted second 
control program into the nonvolatile rewritable 
memory (20) in place of the first control pro- *c 
gram under a condition that the monitor signal 
is indicative of abnormality of the microcom- 
puter (6). 
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